mystic | 0bc640d74dd64f324f73183d63dfbbebee9bf5108e43002eecd9be34e64a038e

Analysis

max time kernel
132s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2023 03:46

Target

NEAS.c37c75cd0e8338d7ad58edfc6bbc08a0.exe
Size

276KB
MD5

c37c75cd0e8338d7ad58edfc6bbc08a0
SHA1

cfe0526e491bc04443a82cc6e7cdf2d281451a00
SHA256

0bc640d74dd64f324f73183d63dfbbebee9bf5108e43002eecd9be34e64a038e
SHA512

18ae7f30fc3a7b4ad5fefa9d832ff89593450bdfe5a92f26113a122563c7315e3b2d068d2a0e7b836a435cacae02757549157f10eb23a9388814310c305a6a58
SSDEEP

6144:bKWeIhzyZNGui/xDD0vlhGxZPeZ/ApmWDOosrQ8o/70IKH:bKWewyixUuxZPeYDOxrQ8o//K

Score

10^/10

mystic stealer

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral2/memory/4840-0-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/4840-2-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/4840-1-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/4840-3-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/4840-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/4840-5-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4988 set thread context of 4840	4988	NEAS.c37c75cd0e8338d7ad58edfc6bbc08a0.exe	90

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 4840	4988	NEAS.c37c75cd0e8338d7ad58edfc6bbc08a0.exe	90
PID 4988 wrote to memory of 4840	4988	NEAS.c37c75cd0e8338d7ad58edfc6bbc08a0.exe	90
PID 4988 wrote to memory of 4840	4988	NEAS.c37c75cd0e8338d7ad58edfc6bbc08a0.exe	90
PID 4988 wrote to memory of 4840	4988	NEAS.c37c75cd0e8338d7ad58edfc6bbc08a0.exe	90
PID 4988 wrote to memory of 4840	4988	NEAS.c37c75cd0e8338d7ad58edfc6bbc08a0.exe	90
PID 4988 wrote to memory of 4840	4988	NEAS.c37c75cd0e8338d7ad58edfc6bbc08a0.exe	90
PID 4988 wrote to memory of 4840	4988	NEAS.c37c75cd0e8338d7ad58edfc6bbc08a0.exe	90
PID 4988 wrote to memory of 4840	4988	NEAS.c37c75cd0e8338d7ad58edfc6bbc08a0.exe	90
PID 4988 wrote to memory of 4840	4988	NEAS.c37c75cd0e8338d7ad58edfc6bbc08a0.exe	90
PID 4988 wrote to memory of 4840	4988	NEAS.c37c75cd0e8338d7ad58edfc6bbc08a0.exe	90

C:\Users\Admin\AppData\Local\Temp\NEAS.c37c75cd0e8338d7ad58edfc6bbc08a0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.c37c75cd0e8338d7ad58edfc6bbc08a0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4840

memory/4840-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4840-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4840-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4840-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4840-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4840-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download